Symfony HtmlSanitizer BIDI Markers Spoofing Vulnerability Fix

Vulnerability Overview This vulnerability affects the component within the Symfony framework, specifically regarding the improper handling of percent-encoded BIDI (Bidirectional Text) markers and Unicode whitespace characters in URLs. Attackers can exploit these special characters to create visual deception, causing users to trust malicious links. Impact Scope Affected Component: The component of Symfony. Affected Versions: v6.4.0 to v6.4.41, and v8.1.0 to v8.1.1. Potential Risk: Attackers can craft URLs containing specific characters, causing the URL displayed in the browser to differ from the actual destination URL. This discrepancy can be leveraged for phishing attacks or other malicious activities. Remediation Plan 1. Code Modifications: - Logic to reject BIDI formatting characters and Unicode whitespace characters has been added in the file. - Specific changes include: - Adding test cases for specific URLs within the method to ensure they are correctly rejected. - Implementing regex matching for BIDI formatting characters and Unicode whitespace characters in the method. If such characters are detected, the method returns . 2. Test Cases: - Additional test cases have been added to to verify that the patched code correctly rejects URLs containing BIDI formatting characters and Unicode whitespace characters. POC Code The following is a comparison of the key code before and after the fix: Before Fix After Fix Test Cases ```php public static function provideParse(): iterable { yield 'http://example.com/foo%00bar' => ['scheme' => 'http', 'host' => 'example.com'], yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield 'http://example.com/foo%00bar' => null, yield '

Goal Reached Thanks to every supporter — we hit 100%!

Symfony HtmlSanitizer BIDI Markers Spoofing Vulnerability Fix

More from this source